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Exhibit B 
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AO 100 (SONY Rev. 01/17) Application IbraSearclt Warrant 


United States District Court 


for the 


Southerr];)Qjfj^^‘(jlfOf New York 


In the Matter of the Search of 

/firiejiy describe the properly to he searched 
nr identify the person hy name and address) 

200 East 39th Street, Apartment SC, New York, New 
York 10016, as well as Any Closed Containers/Items 


j 1T MAG 

) Case No. 



application for a search and seizure warrant 

1, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty' of perjury that I have reason to believe that on the following person or property (idemfy the parson or describe the 
property to he searched and yive its location): 

200 East 39th Street, Apartment 8C, New York, New York 10016 

located in the Southern _ District of_N ew York __, there is now concealed/'Wwaytr/n; 

person or describe the property to be seised)'. 

See Attached Affidavit and its Attachment A 


The ba.sis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

S evidence of a crime; 

SI contraband, fruits of crime, or other items illegally possessed: 

E) property desigiteci for use, intended for use, or used in committing a crime; 
O a person to be arrested ora person who is unlawfully restrained. 


The search is related to a violation of: 

Code Sectionfx) Qffeme Descriplmi(s) 

18 U.S.C. 793(d), 793(e), Offenses relating to unauthorized possession and distribution of 
1030(a){1), 1030(a)(2)(B). national defense information 

The application is based on these facts: 

See Attached Affidavit and its Attachment A 


^ Continued on the attached sheet. 

^ Delayed notice of 30 days (give exact ending date if more limn 30 days: 
under IS U.S.C. § 3163a, the basis of which is separthon the al^ecl^ieet 


) is requested 


Sworn to before me and signed in my presence. 

' V-Tb tx.V\ . 


3 - 


Date: mm morf- 

City and state: N ew Y ork, W _ 



Special Agen t Jsff fi; Diohaldson, FBI _ 

Printeddcwie and tide 


c 


'T. 








~^^^nTlge ‘s .dgnpiiirf^ 

Honropble Parbara c! Mbsec— 

Printed name and tide 


JAS 027088 
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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of the Application of the United TO BE FILED UNDER SEAL 

States of America for a Search Warrant for the 

Premises Known and Described as 200 East 39th Agent Affidavit in Support of 

Street, Apartment 8C, New York, New York Application for Search Warrant 

10016, as well as Any Closed Containers/Items 
Contained in the Premises 

SOUTHERN DISTRICT OF NEW YORK) ss.: 

JEFF D. DONALDSON, being duly sworn, deposes and says: 

1. Introduction 

A. Affiant 

1. I am a Special Agent of the Federal Bureau of Investigation (“FBP’) assigned to the 
New York Field Office, and have been employed by the FBI since 2010.1 am currently assigned 
to a squad responsible for counterespionage matters and have worked in the field of 
counterintelligence from 2010 to present. In the course of my duties as a Special Agent, I am 
responsible for investigating offenses involving espionage and related violations of law, including 
unauthorized retention, gathering, transmitting or losing classified documents or materials; 
unauthorized removal and retention of classified documents or materials; illegally acting in the 
United States as a foreign agent; other national security offenses; and the making of false 
statements. As a result of my involvement in espionage investigations and investigations involving 
the unauthorized disclosure or retention of classified information, as well as my training in 
counterintelligence operations, I am familiar with the tactics, methods, and techniques ol United 
States persons who possess, or have possessed a United States Government security clearance and 
may choose to harm the United States by misusing their access to classified information. 1 am also 
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familiar, though my training and experience with the use of computers in criminal activity and the 
forensic analysis of electronically stored information. 

2. 1 make this Affidavit in support of an application pursuant to Rule 41 of the Federal 
Rules of Criminal Procedure for a second warrant to search the premises specified below (the 
“Subject Premises”) for the items and information described in Attachment A. This Affidavit is 
based upon my personal knowledge; my review of documents and other evidence; my 
conversations with other law enforcement personnel; and iny training, experience and advice 
received concerning the use of computers in criminal activity and the forensic analysis of 
electronically stored information (“ESI”). Because this Affidavit is being submitted for the limited 
purpose of establishing probable cause, it does not include all the facts that I have learned during 
the course of my investigation. Where the contents of documents and the actions, statements, and 
conversations of others are reported herein, they are reported in substance and in part, except where 
otherwise indicated. 

B. The Subject Premises 

3. The Subject Premises is particularly described as apartment 8C in a residential 
apartment building located at 200 East 39th Street, New York, New York 10016 (the “Building”). 
The Building is located near the corner of 39th Street and Third Avenue in Manhattan. The 
Building is nineteen stories high and contains approximately ninety-one apartment units. The 
Subject Premises is a one-bedroom apartment located on the eighth floor of the Building, and it is 
clearly identifiable as Apartment 8C from the outside of the Subject Premises. 

C. The Subject Offenses 

4. For the reasons detailed below, I believe that there is probable cause that the Subject 
Premises contain evidence, fruits, and instrumentalities of (i) the unauthorised possession and, 
in/ar alia, the communication of national defense information to someone not entitled to receive 
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it, in violation of Title 18. United States Code, Section 793(d); (ii) the unlawful retention of 
national defense information, in violation of Title 18, United States Code, Section 793(e); (iii) 
exceeding authorized access to a computer in order to obtain national defense information with 
reason to believe that information could be used to the injury of the United States and the advantage 
of a foreign nation and willfully transmitting that information to a person not entitled to receive it, 
in violation of Title 18, United States Code, Section 1030(a)(1); and (iv) intentionally exceeding 
authorized access to a computer and thereby obtaining information from a department or agency 
of the United States, in violation of Title 18, United Stales Code, Section 1030(a)(2)(B) 
(collectively the “Subject Offenses”). 

D. Terminology 

5. The term “computer,” as used herein, is defined as set forth in 18 U.S.C. 
§ 1030(e)(1). 

6. The terms “records,” “documents,” and “materials” include all information 
recorded in any form, visual or oral, and by any means, whether in handmade form (including, but 
not limited to, writings, drawings, paintings), photographic form (including, but not limited to, 
microfilm, microfiche, prints, slides, negatives, videotapes, motion pictures, photocopies) or 
electrical, electronic or magnetic form (including, but not limited to, tape recordings, cassettes, 
compact discs, electronic or magnetic storage devices such as floppy diskettes, hard disks, CD- 
ROMs, digital video disks (DVDs), Personal Digital Assistants (PDAs), Multi Media Cards 
(MMCs), memory sticks, optical discs, printer buffers, smart cards, memory calculators, electronic 
dialers. Bernoulli drives, or electronic notebooks, as well as digital data files and printouts or 
readouts from any magnetic, electrical or electronic storage device), as well as the equipment 
needed to record such information (including but not limited to cameras and video recording and 
storage devices). 

3 - 
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II. Probable Cause and Request to Search 

7. On March 13, 2017, the Honorable Barbara G. Moses issued a search warrant for 
the Subject Premises (the “Covert SW'). The Covert SW authorized law enforcement officers to 
search the Subject Premises covertly without advance or contemporaneous notice of the execution 
of the warrant. The application in support of the Covert SW is attached as Exhibit A to this 
application and is incorporated herein by reference (the “Covert SW Application"), 

8. During the afternoon of March 13, 2017, I and other law enforcement officers, 
including an FBI agent who specializes in imaging or otherwise copying electronic devices (the 
“CART Personnel”), executed the Covert SW at the Subject Premises without providing advance 
or contemporaneous notice of the execution of the warrant (“Search-1"). During Search-1, I 
observed, among other things, a desktop computer, a computer server rack with at least one server 
in it, at least five external hard drives, and other electronic devices (together, the “Electronic 
Devices”), which together are believed to comprise multiple terabytes of computer storage. Based 
on my training and experience, as well as my discussions with the CART Personnel, 1 know, 
among other things, that attempting to image or copy the Electronic Devices in the Subject 
Premises would have been extremely time-consuming and would have risked alerting JOSHUA 
SCHULTE and/or other residents of the Apartment Building to the search of the Subject Premises. 
As a result, I and the other law enforcement officers terminated Search-] and left the Subject 
Premises. 

9. Based on the results of Search-1,1 am seeking authorization for a second search of 
the Subject Premises for the same items and information, and under the same procedures as set 
forth in the Covert SW Application. (&e Covert SW Application, Parts III, IV.) Based, in part, 
on the fact that it is impractical to search the Subject Premises covertly, this application does not 

seek authorization to execute the warrant without providing advance or contemporaneous notice 
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of the execution ofthe warranl. Rather, upon the execution of this warrant, notice will be provided 
at or as soon as possible after the execution of the search. Law enforcement officers will also 
provide notice of Search-1 at the time they execute the second search. 

10. As described in detail in the Covert SW Application, SCHULTE is believed to 
possess sophisticated computer skills and may be able to delete or activate encryption programs 
that would make his devices virtually impossible to access if he has advance notice ofthe search. 
Accordingly, 1 am also requesting authority to execute the search warrant at any time in the day or 
night in order to allow law enforcement officers to e,xecLite the warrant in a manner that will 
decrease the likelihood that SCHULTE is able to destroy evidence. 

HI. Conclusion and Ancillary Provisions 

11. Based on the foregoing, I respectfully request the court to issue a warrant to search 
and seize the items and information specified in Attachment A to this Affidavit and to the Search 
and Seizure Warrant. 

12. In light ofthe confidential nature of the continuing investigation, I respectfully 
request that this Affidavit and all papers submitted herewith be maintained under seal until the 
Court orders otherwise. 



.lEFl/D. DONALDg-O-N 
Spe^cial Agent 

Federal Bureau of Investigation 



Sworn to before me on 
this Idtirday of March 2017 


UNITEDiSTATES MAGISTRATE JUDGE 
SOUTHERN blSTlpCt OF NEW YORK 
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Attachment A 

I. Premises to be Searched—Subject Premises 

The premises to be searched (the “Subject Premises”) is described as follows, and includes 

all locked and closed containers found therein: 

The Subject Premises is particularly described as apartment 8C in a building located at 200 
East 39th Street, New York, New York 10016 (the “Building”). The Building is located 
near the corner of 39th Street and Third Avenue, The Building is nineteen stories high and 
contains approximately ninety-one apartment units. The Subject Premises is a one- 
bedroom apartment located on the eighth floor of the Building, and it is clearly identifiable 
as apartment 8C from the outside of the Subject Premises. 

IL Execution of the Warrant 

Law enforcement agents are permitted to execute the search warrant at any time in the day 
or night. Upon the execution of this warrant, notice will be provided at or as soon as possible after 
the execution of the search. 

Ill, Items to Be Searched and Seized 

A, Evidence, Fruits, and Instrumentalities of the Subject Offenses 
The items to be searched and/or seized from the Subject Premises include the following 
evidence, fruits, and instrumentalities of: (i) the unauthorized possession and, inter alia, the 
communication of national defense infonnation to someone not entitled to receive it, in violation 
of Title 18, United States Code, Section 793(d); (ii) the unlawful retention of national defense 
information, in violation of Title 18, United States Code, Section 793(e); (iii) exceeding authorized 
access to a computer in order to obtain national defense infoimation with reason to believe that 
information could be used to the injiiiy of the United Slates and the advantage of a foreign nation 
and willfully transmitting that information to a person not entitled to receive it, in violation of Title 
18, United States Code, Section 1030(a)(1); and (iv) intentionally exceeding authorized access and 
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thereby obtaining inrormation from a department or agency of the United States, in violation of 
Title 18, United States Code, Section 1030(a)(2)(B) (collectively, the “Subject Offenses”): 

1. Evidence concerning occupancy or ownership of the Subject Premises, including 
without limitation, utility and telephone bills, mail envelopes, addressed correspondence, diaries, 
statements, identification documents, address books, telephone directories, and keys. 

2. Evidence concerning the identity or location of, and communications with, any co- 
conspirators. 

3. Any and all notes, documents, records, correspondence, or materials, in any format 
and medium (including, but not limited to, envelopes, letters, papers, e-mail messages, chat logs 
and electronic messages, other digital data files and web cache information, and handwritten 
notes), pertaining to the unauthorized retention, gathering, and transmission of classified 
documents or materials, and the unauthorized removal and retention of classified documents or 
materials. 

4. Electronic devices (including but not limited to computers, tablets, smartphones, 
and cellular telephones) and storage media used in furtherance of the Subject Offenses, containing 
evidence of the Subject Offenses, or containing evidence authorized for seizure in paragraphs 1,2 
and 3 above. The term “storage media” includes any physical object upon which computer data 
can be recorded. Examples include hard disks. RAM, floppy disks. Hash memory, CD-ROMs, 
and other magnetic or optical media. 
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5. Eleclronic forensic evidence relating to the Subject Offenses, including for any 
electronic device or storage media whose searcli and/or seizure is authorized by this vvarrtint as 
described above in paragraph 4 (hereinafter, “Computers”’), including: 

a. evidence of the times the Computers were used in furtherance of the Subject 
Offenses; 

b. passwords, encryption keys, and otiier access devices that may be necessary to 
access the Computers; 

c. documentation and manuals that may be necessary to access the Computers or 
to conduct a forensic examination of the Computers; 

d. evidence of software that would allow others to control the Computers, such as 
viruses, Trojan horses, and other forms of malicious software, as well as 
evidence of the presence or absence of security software designed to detect 
malicious software; 

e. evidence indicating how and when the Computers were accessed or used in 
furtherance of the Subject Offenses; 

f. evidence indicating the Computers’ user’s/users’ state of mind as it relates to 
the Subject Offenses; 

g. evidence of the attachment to the Computers of other storage devices or similar 
containers for electronic evidence in furtherance of the Subject Offenses; 


' The term “■computer” includes all types of electronic, magnetic, optical, electrochemical, or other 
high speed data processing devices performing logical, arithmetic, or storage functions, including 
desktop computers, notebook computers, mobile phones, tablets, server computers, and network 
hardware. 
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h. evidence of countei-fdrensic programs (and associated data) that are designed 
to eliminate data from the Computers; 

i. records of or information about Internet Protocol addresses used by the 
Computers; 

j. records of or information about the Computers’ Internet activity in furtherance 
of the Subject Offenses, including firewall logSj caches, browser history and 
cookies, “bookmarked” or “favorite” web pages, search terms that the user 
entered into any Internet search engine, and records of user-typed web 
addresses. 

6. If law enforcement personnel seize the computer(s) or other electronic device(s), 
the personnel will search the computer and/or device(s) within a reasonable amount of time, not 
to exceed 60 days from the date of execution of the warrant. If, after such a search has been 
conducted, it is determined that a coihputer or device contains any data listed in paragraphs 1 
tlu'ough 3, the Government will retain the computer or device. If it is determined that the 
computer(s) or device(s) are no longer necessary to retrieye and preserve the data, and the items 
are not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(b), such materials 
and/or equipment will be returned within a reasonable time. In any event, such materials and/or 
equipment shall be returned no later than 60 days from the execution of this warrant, unless further 
application is made to the Court. 

B. Search and Seizure of Electronically Stored Information 

The items to be searched and seized from the Subject Premises also include any computer 
devices and storage media that may contain any electronically stored information falling within 
the categories set forth in Section III.A of this Attachment above, including, but not limited to, 
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desktop and laptop computers, disk drives, modems, thumb drives, personal digital assistants, 
smart phones, digital cameras, and scanners. The items to be searched and seized from the Subject 
Premises also include: 

1. Any items or records needed to access the data stored on any seized or copied 
computer devices or storage media, including but not limited to any physical keys, encryption 
devices, or records of login credentials, passwords, private encryption keys, or similar information. 

2. Any items or records that may facilitate a forensic examination of the computer 
devices or storage media, including any hardware or software manuals or other information 
concerning the configuration of the seized or copied computer devices or storage media. 

3. Any evidence concerning the persons with access to, control over, or ownership of 
the seized or copied computer devices or storage media. 

C. Review of ESI 

Following seizure of any computer devices and storage media and/or the creation of 
forensic image copies, law enforcement personnel (including, in addition to law enforcement 
officers and agents, and depending on the nature of the ESI and the status of the investigation and 
related proceedings, attorneys for the government, attorney support staff, agency personnel 
assisting the government in this investigation, and outside technical experts under government 
control) are authorized to review the ESI contained therein for information responsive to the 
warrant. 

In conducting this review, law enforcement personnel may use various techniques, 
including but not limited to: 
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• surveying various file “directories" and the individual files they contain (analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a drawer 
believed to contain pertinent files); 

• opening or cursorily reading the fust few "pages" of such files in order to determine 
their precise contents; 

• scanning storage areas to discover and possibly recover recently deleted files; 

• scanning storage areas for deliberately hidden files; 

• performing key word searches llirough all electronic storage areas to determine whether 
occurrences of language contained in such storage areas exist that are intimately related 
to the subject matter of the investigation; and 

• making reasonable efforts to utilize computer search methodology to search only for 
files, documents, or other electronically stored information within the categories 
identified in Sections l.A and I.B of this Attachment. 
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AO (SDNY Rev. 01/17) Senreh ami Seizure Warranf 

United States District Court 

\ Southern New York) 

III the Matter of the Search of ) 

(ISrie/ly describe the properly to be searched ) 

or ukiaify the person by name and address) ) 

200 East 39th Street. Apartment 8C, New York, New } 

York 10016, as well as Any Closed Containers/ltems; ' 

See Attachment A ' 

SEARCH AND SEIZURE WARRANT 

To: Any aiitiiorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the searcli 
of the following person or property located in the_ Southern .. District of __Ji6VlYoik_____ 

(identify the person or describe the properly to be searched andghc its location)', 

200 East 39th Street, Apartment 8C, New York, New York 10016; see Attachment A 

The person or property to be searched, described above, is be I ieved to conceal (identify the person or describe the property 
to he seized)'. 

See Attachment A 



The search and seizure are related to violation(s) of (inseri statutory citations): 


18 U.S.C. 793(d), 793(e), 1030(a)(1), 1030(a)(2)(B). 


find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 


property. 


YOU ARE COMMANDED to execute this warrant on or before 


March 27, 2017 


(not to exceed 14 days) 

□ in the daytime 6:00 a.m. to 10 p.m. Sf at any time in the day or night as 1 find reasonable cause has been 

established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 

The officer executing this warrant, or an officer present during the e.xecution of the warrant, must prepare an 
inventory as required by laAV and promptly return this warrant and inventor^ to the Clerk ot the Court. 

cl Upon its return, this warrant and inventory should be filed under seal by the Clerk of the Court.- 

' (JSMJ Imiials 


pf 1 find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (qxeop’t for delgy 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or wfiose, [)i'bt)erty, ,>y!!), be 
sattched or seized (check the appropriatefox) SlfOT _ ^0 days (not to exceed30), , ' / ' ’ 


Date and time issued: 


City and state: New York, NY 


□until, the facts justifying, the later specific ddte)Qf 





jHonma^e B arbara,C . IViosds 

i’rinted name and title > 


JAS 027100 
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AO 93 (SONY Rev. 01/17) Search and Seizure Warrant (I’age 2) 



Return 


Case No,; 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventor)' made in the presence of: 


Inventory of the property taken and name of any pcrson(s) seized; 



Certification 

I declare under penalty of perjury that this inventoiy is correct and was returned along with the original warrant 
to the Court. 


Dale:_ ___. ^ 

Kxecuiing q/Jicer ‘s signal lire 


Printed name and liile 


JAS 027101 
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Attachment A 

I. Premises to be Searched—Subject Premises 

The premises to be searched (the “Subject Premises”) is described as follows, and includes 
all locked and closed containers found therein: 

The Subject Premises is particularly described as apartment 8C in a building located at 200 
East 39th Street, New York, New York 10016 (the “Building”). The Building is located 
near the comer of 39th Street and Third Avenue. The Building is nineteen stories high and 
contains approximately ninety-one apartment units. The Subject Premises is a one- 
bedroom apartment located on the eighth floor of the Building, and it is clearly identifiable 
as apartment 8C from the outside of the Subject Premises. 

II. Execution of the Warrant 

Law enforcement agents are permitted to execute the search warrant at any time in the day 
or night. Upon the execution of this warrant, notice will be provided at or as soon as possible after 
the execution of the search. 

III. Items to Be Searched and Seized 

A- Evidence, Fruits, and Instrumentalities of the Subject Offenses 
The items to be searched and/or seized from the Subject Premises include the following 
evidence, fruits, and instrumentalities of: (i) the unauthorized possession and, inter alia, the 
communication of national defense information to someone not entitled to receive it, in violation 
of Title 18, United States Code, Section 793(d); (ii) the unlawful retention of national defense 
information, in violation of Title 18, United States Code, Section 793(e); (iii) exceeding authorized 
access lo a coniputer in order to obtain national defense information with reason to believe that 
information could be used to the injury of the United States and the advantage of a foreign nation 
and willfully transmitting that information to a person not entitled to receive it, in violation of Title 
18, United States Code, Section 1030(a)(1); and (iv) intentionally exceeding authorized access and 
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thereby obtaining information from a department or agency of the United States, in violation of 
Title 18, United Stales Code, Section 1030(a)(2)(B) (collectively, the “Subject Offenses”): 

1. Evidence concerning occupancy or ownership of the Subject Premises, including 
without limitation, utility and telephone bills, mail envelopes, addressed correspondence, diaries, 
statements, identification documents, address books, telephone directories, and keys. 

2. Evidence concerning the identity or location of, and commimications.jvith, any co- 
conspirators. 

3. Any and all notes, documents, records, correspondence, or materials, in any format 
and medium (including, but not limited to, envelopes, letters, papers, e-mail messages, chat logs 
and electronic messages, other digital data files and web cache information, and handwritten 
notes), pertaining to the unauthorized retention, gathering, and transmission of classified 
documents or materials, and the unauthorized removal and retention of classified documents or 
materials. 

4. Electronic devices (including but not limited to computers, tablets, smartphones, 
and cellular telephones) and storage media used in furtherance of the Subject Offenses, containing 
evidence of the Subject Offenses, or containing evidence authorized for seizure in paragraphs 1,2 
and 3 above. The term “storage media” includes any physical object upon which computer data 
can be recorded. Examples include hard disks, RAM, floppy disks, Hash memory, CD-ROMs, 
and other magnetic or optical media. 
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5. Electronic forensic evidence relating to the Subject Offenses, including for any 
electronic device or storage media whose search and/or seizure is authorized by this warrant as 
described above in paragraph 4 (hereinafter, “Computers”*), including; 

a. evidence of the times the Computers were used in furtherance of the Subject 
Offenses; 

b. passwords, encryption keys, and other access devices that may be necessary to 
access the Computers; 

c. documentation and manuals that may be necessary to access the Computers or 
to conduct a forensic examination of the Computers; 

d. evidence of software that would allow others to control tire Computers, such as 
viruses, Trojan horses, and other forms of malicious software, as well as 
evidence of the presence or absence of security software designed to detect 
malicious software; 

e. evidence indicating how and when the Computers were accessed or used in 
furtherance of the Subject Offenses; 

f. evidence indicating the Computers’ user’s/users’ state of mind as it relates to 
the Subject Offenses; 

g. evidence of the attachment to the Computers of other storage devices or similar 
containers for electronic evidence in furtherance of the Subject Offenses; 


' The term “computer” includes all types of electronic, magnetic, optical, electrochemical, or other 
high speed data processing devices performing logical, arithinetic, or storage functions, including 
desktop computers, notebook computers, mobile phones, tablets, server computers, and network 
hardware. 
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h. evidence of counter-forensic programs (and associated data) that are designed 
to eliminate data from the Computers; 

i. records of or information about Internet Protocol addresses used by the 
Computers; 

j. records of or information about the Computers’ Internet activity in furtherance 
of the Subject Olfenses, including firewall logs^ caches, browser history and 
cookies, “bookmarked” or “favorite” web pages, search terms that the user 
entered into any Internet, search eitgine, and records of user-typed web 
addresses. 

6. If law enforcement personnel seize the computer(s) or other electronic device(s), 
the. personnel will search the computer and/or device(s) within a reasonable amount of time, not 
to exceed 60 days from the date of execution of the warrant. If, after such a search has been 
conductedj it is determined that a computer or device contains any data listed in paragraphs 1 
through 3, the Government will retain the computer or device. If it is determined that the 
computer(s) or device(s) are no. longer neeessai^ to retrieye and preserve the data, and the items 
are not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(b), such materials 
and/or equipment will be remrned within a reasonable time. In any event, such materials and/or 
equipment shall be returned no later than 60 days from the execution of this warrant, unless further 
application is made tO the Court. 

B. Search and Seizure of Electronically Stored Information 

The items to be searched and seized from the Subject Premises also include any computer 
devices and storage media that may contain any electronically stored information falling within 
the categories set forth in Section IIl.A of this Attachment above, including, but not limited to, 
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desktop and laptop computers, disk drives, modems, thumb drives, personal digital assistants, 
smart phones, digital cameras, and scanners. The items to be searched and seized from the Subject 
Premises also include; 

1. Any items or records needed to access the data stored on any seized or copied 
computer devices or storage media, including but not limited to any physical keys, encryption 
devices, or records of login credentials, passwords, private enc)r>'ption keys, or similar information. 

2. Any items or records that may facilitate a forensic examination of the computer 
devices or storage media, including any hardware or software manuals or other information 
concerning the configuration of the seized or copied computer devices or storage media. 

3. Any evidence concerning the persons with access to, control over, or ownership of 
the seized or copied computer devices or storage media. 

C. Review of ESI 

Following seizure of any computer devices and storage media and/or the creation of 
forensic image copies, law enforcement personnel (including, in addition to law enforcement 
officers and agents, and depending on the nature of tlie ESI and the status of the investigation and 
related proceedings, attorneys for the government, attorney support staff, agency personnel 
assisting the government in this investigation, and outside technical experts under govenmient 
control) are authorized to review the ESI contained therein for information responsive to the 
warrant. 

In conducting this review, law enforcement personnel may use various techniques, 
including but not limited to: 
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• surveying various file “directories" and the individual files they contain (analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a drawer 
believed to contain pertinent files); 

• opening or cursorily reading the first few "pages" of such files in order to determine 
their precise contents; 

• scanning storage areas to discover and possibly recover recently deleted files; 

• scanning storage areas for deliberately hidden files; 

• performing key word searches through all electronic storage areas to determine whether 
occurrences of language contained in such storage areas exist that are intimately related 
to the subject matter of the investigation; and 

• making reasonable efforts to utilize computer search methodology to search only for 
files, documents, or other electronically stored information within the categories 
identified in Sections I.A and l.B oflhis Attachment. 
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